Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 26 Jun 2002 05:39:40 +0200
From:      Barry Irwin <bvi@itouchlabs.com>
To:        Luigi Rizzo <luigi@iet.unipi.it>
Cc:        Suresh Ramasamy <sureshdr@time.net.my>, ipfw@freebsd.org
Subject:   Re: Question on Filtered Bridging and ARP takeovers
Message-ID:  <20020626053940.T46303@itouchlabs.com>
In-Reply-To: <20020625055457.B24694@iguana.icir.org>; from luigi@iet.unipi.it on Tue, Jun 25, 2002 at 05:54:57AM -0700
References:  <5.1.0.14.2.20020625120053.02bf64e8@pop.time.net.my> <5.1.0.14.2.20020625120053.02bf64e8@pop.time.net.my> <20020624215809.A21492@iguana.icir.org> <5.1.0.14.2.20020625130437.02cf03f0@pop.time.net.my> <20020625055457.B24694@iguana.icir.org>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help

agreed. units that I've read about that implement this, usually release
their ARP  as soonas they see a system reply with a valid response to an arp
request, such as when a new system is turned on.  I have not heard f one
like this that uses ICMP to check the availability, but rather thy monito
unanswered arp requests.

Barry


On Tue 2002-06-25 (05:54), Luigi Rizzo wrote:
> 
> sounds like it is the "new firewall" that is broken, not FreeBSD!
> 
> 	cheers
> 	luigi
> 
> On Tue, Jun 25, 2002 at 01:24:51PM +0800, Suresh Ramasamy wrote:
> > Thanks Luigi,
> > 
> > I've installed a filtered bridging running on FreeBSD 4.5 Stable
> > with these config
> > 
> > WAN ---------- FB (10.10.68.181) ---- Client (10.10.68.222)
> >              |
> >            +---------- the rest of 10.10.68.x
> > 
> > Recently, a new firewall was introduced and this firewall was using an 
> > active ARP
> > scanning that "overtakes" IP that does not respond to ping.
> > 
> > The client 68.222 is ICMP disabled with only a few TCP ports open.
> > What i noticed is that when I ping from WAN segment to the client,
> > in the FB, it shows that ARP is taken over by the rogue firewall.
> > 
> > Temporary Workaround
> > 
> > I added a static ARP entry onto FB (arp -S 10.10.68.222 mac_address pub) to
> > publish the ARP into the network segment switch.
> > 
> > Or is there a documented workaround?
> > 
> > 
> > Q: Should the bridge function on FreeBSD address the ARP poisoning issue?
> > If so, I would like to recommend an addition of this into the bridge function
> > to identify network at the other end and establish an arp broadcasting 
> > function for
> > the segment behind the filtered bridging.
> > 
> > At 12:58 PM 6/25/2002, you wrote:
> > >On Tue, Jun 25, 2002 at 12:01:46PM +0800, Suresh Ramasamy wrote:
> > > > I have a question on FreeBSD filtered bridging and ARP
> > > > takeovers. Could i direct the question to you, or specifically to
> > > > a mailing list?
> > >
> > >just ask both me and ipfw@freebsd.org
> > >
> > >luigi
> > 
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-ipfw" in the body of the message
> 
> 

--
Barry Irwin		bvi@itouchlabs.com			+27214875177
Systems Administrator: Networks And Security
Itouch Labs 		http://www.itouchlabs.com		South Africa


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ipfw" in the body of the message




Want to link to this message? Use this URL: <http://docs.FreeBSD.org/cgi/mid.cgi?20020626053940.T46303>